{"api_version":"1","generated_at":"2026-11-13T01:07:56+00:00","cve":"CVE-2026-107152","urls":{"html":"https://cve.report/CVE-2026-107152","api":"https://cve.report/api/cve/CVE-2026-107152.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-107152","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-107152"},"summary":{"title":"Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed","description":"An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.","state":"PUBLISHED","assigner":"redhat","published_at":"2026-11-12 20:18:14","updated_at":"2026-11-13 00:20:06"},"problem_types":["CWE-287","CWE-287 Improper Authentication"],"metrics":[{"version":"3.1","source":"secalert@redhat.com","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:99952","name":"https://access.redhat.com/errata/RHSA-2026:99952","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:99949","name":"https://access.redhat.com/errata/RHSA-2026:99949","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:99950","name":"https://access.redhat.com/errata/RHSA-2026:99950","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547374","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2547374","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2026-107152","name":"https://access.redhat.com/security/cve/CVE-2026-107152","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107152","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107152","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","version":"unaffected 0:0.9.3-2.el8sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","version":"unaffected 0:0.9.3-2.el8sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 9","version":"unaffected 0:0.9.3-2.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 9","version":"unaffected 0:0.9.3-2.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:0.9.4-2.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:0.9.4-2.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.18 for RHEL 9","version":"unaffected 0:0.9.4-2.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.18 for RHEL 9","version":"unaffected 0:0.9.4-2.el9sat * rpm","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-10-07T00:00:00.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-11-12T18:46:00.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Red Hat would like to thank Arpit Jain (Independent Security Researcher) for reporting this issue.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]}],"credits":[{"lang":"en","value":"Red Hat would like to thank Arpit Jain (Independent Security Researcher) for reporting this issue."}],"datePublic":"2026-11-12T18:46:00.000Z","descriptions":[{"lang":"en","value":"An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T23:56:19.679Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"RHSA-2026:99949","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"name":"RHSA-2026:99950","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"name":"RHSA-2026:99952","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-107152"},{"name":"RHBZ#2547374","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547374"}],"timeline":[{"lang":"en","time":"2026-10-07T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-11-12T18:46:00.000Z","value":"Made public."}],"title":"Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed","workarounds":[{"lang":"en","value":"Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available."}],"x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-287: Improper Authentication"}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2026-107152","datePublished":"2026-11-12T20:04:09.664Z","dateReserved":"2026-10-07T10:19:09.047Z","dateUpdated":"2026-11-12T23:56:19.679Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 20:18:14","lastModifiedDate":"2026-11-13 00:20:06","problem_types":["CWE-287","CWE-287 Improper Authentication"],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"107152","Ordinal":"1","Title":"Rubygem-smart_proxy_dynflow: dynflow console authorizes any clie","CVE":"CVE-2026-107152","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"107152","Ordinal":"1","NoteData":"An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.","Type":"Description","Title":"Rubygem-smart_proxy_dynflow: dynflow console authorizes any clie"}]}}}